8f43145c503ae4c7e7892b6ba9b29f6428f4bc2e234ec4b4af891f4be3408de0

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

764ac64a6075ee58c99e828b22da54cb_JaffaCakes118.html
Size

30KB
MD5

764ac64a6075ee58c99e828b22da54cb
SHA1

8f993d4a80346490c5981a28a8fe45a90710885e
SHA256

8f43145c503ae4c7e7892b6ba9b29f6428f4bc2e234ec4b4af891f4be3408de0
SHA512

b73bbcdf892dd97d19ba0b3effd77f5eb7a2e0841db77682466df27a30b88921f0f4ca3b72d29be576a175c5f1bc36c9892e609b912d2cf817a4a9f9145be5bf
SSDEEP

192:uwjZGb5n8RTWnQjxn5Q/mnQieFNn88nQOkEnta0nQTbnNnQmScxjRdiH621Cx8PM:LQ/mN7xjRdl21N9Cl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D49FC4B1-1B87-11EF-8C89-6200E4292AD7} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422907434"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2836	2244	iexplore.exe	28
PID 2244 wrote to memory of 2836	2244	iexplore.exe	28
PID 2244 wrote to memory of 2836	2244	iexplore.exe	28
PID 2244 wrote to memory of 2836	2244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\764ac64a6075ee58c99e828b22da54cb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39d671ea7fd670ccbdbf875bb7cdf88e

SHA1
c862783ae24cb986cb10607230a93f9e60b54aa9

SHA256
d41056c99b312801735e4fa22e5be9fef4a2152cc6fd910a40535fd8db71d992

SHA512
660988a3d864dad4ef621ab873d15ee689f0e2d7a1d174f7337572e4daf3223a14e34c4398952d4224f29d400e538a320cb5d5702822d6b9f1caaed7e8ade204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4902644ed8c3954594842f2a1970393

SHA1
a14080dc0ef7e41fd5743992284bb6f936e429ea

SHA256
d90671e364e97a237a5784f7726dc492b0b56abc9a0ba6c28e8650e4f2411b5a

SHA512
b4e1b60c29d1b8c41069c69d4c608e4e5f8b036d9456f7dfdf1e9e017c36e6a567882d60779ba40306c162c6a16c46fdf0803d58ad20450e3657e26c28165108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2372130a0dfc4cc860fc58231e8bcea6

SHA1
51006d6a2ab295862c03e2d993be2187658e20fa

SHA256
aa4cf5c73b0f3f33dac486f92e64f672f938df4c2bf02752f0722c7fc20a14ff

SHA512
dfea935d0377d1f43aa8a42aab5c44758f9d034bdcf749a5414bdafaa535f95ba38960fcadb6c511aa2495e4317377b149a9abae12ad7a1ee8535468c53918f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fabc13252fc8f19ba8e4194e828b9f91

SHA1
336f1600094d997a6d3c56176ca53aa072ba4648

SHA256
7bd532dfd8ef0da3166f4a8bb47b5e322c37c8cfe5808cd778fa1afb61855231

SHA512
8ba3c6bac97976367a3b83aab74b1818f438fed5961ab7a1e9e12522afeea13dece011dae1788f91986382ec6133634fdd1cdd228dedb6c9f10cf521e3142e9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d70dbb365b2d1b10957944626425835c

SHA1
1a45a79ed9b28beb2f4edfbd7de6c81a224da4d1

SHA256
af760a24ff81c34d047f7bf319dd00431484327a9ae5c345dbbfe722e89c9f8d

SHA512
b77a08d9eb6af32f0f7c3120aea0fe9aa3511433a984c17ab7377a2d6f1f61d36465672dbcb688d581a8645dea8df5e86f0250033e735440c7a74499f05075c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf80e0427bb1f9a54eac75e7b90674a3

SHA1
88567b36039c858316f1f445ca5c13735affd85a

SHA256
c2c1e31025e8653f5b062690d36882768ed1ae2778cba36de3efc6193c43705c

SHA512
c32d776cd71d2051c9471756eb326d6c0fe74b587381b0974ceb916f0019ef970d4f263c7017a15455834e79551b089b7802653f3a49792f4178a7c4123fc0f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64a212204fb3715ce79fab9d248bee25

SHA1
a93f123266f0fe77f7cde9c30b3d9a3fd9351e8b

SHA256
00ed1484792a615b779117697570aa75f9fc04ea3caa95305e06ed7f9eff98ff

SHA512
51bf3a7893df788a28abad85b1ca733da6386281da7dc9eb3377b1c66a21f9cf4a6bdca1e04909a22e3b62f24c21f26dfdd55bce196cccd43758e167bc8d893d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
841cc3174f8af4ab1686e5af8b8ac1a3

SHA1
ee146254fb166839320974cd6237c36670a328f1

SHA256
573050c1c6734900f1e5364893f2d5034918f1ddeb1402c8aa167a2056934ff7

SHA512
7fc051c003f2885bda41ad3d8424b77e2188f6071f77afec10827ea2d5fc6c3856f474f5aa60648ec3a0faa9bbdbf6f37ede0f35947877104880769925f1d6a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25337853a63c63744611848d2d6c4a5c

SHA1
92464b97afd70fdb6df1d43a8038716b3528a0aa

SHA256
93b5599f0ae6bce8af2f5a08a06d1bfadcd86a3f8fc15ec14024f6111dec00ee

SHA512
20f9156ecbbf1c7be1efbf8b44d818b3d28071112f56cf0ac93ac6fe2d635debddfde87568acbd6bda2af35146ee96c3fe5fc387aa205ba685bcde061b361bfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab234B.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23AC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit